gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-25 21:20:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bind standalone consent proof only to unattended updates

Browse Source 
Register the real shell verifier for the updater without admitting it as proof for unrelated installers. Preserve exact installer requirements and test missing/unrelated proof rejection.

Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot]
2026-10-07 15:16:10 +01:00
parent fb109ada1d
commit b6efefe52f
4 changed files with 65 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/release-control/v6/internal/subsystems/deployment-installability.md
+3
View File
@@ -38,6 +38,9 @@ against valid and adverse configuration bytes, including padded RC and nested
opt-in. `TestAutoUpdateConsentKeepsTimerAndParserBoundaries` checks legacy timer
consent, missing parser and nonregular configuration. These are source-level
ordinary-user fixtures, not installed timer/systemd or update acceptance.
The registry binds the standalone verifier only to the unattended updater's
runtime policy. It cannot satisfy the archive, PowerShell, Docker or other
installer policies; their existing exact verification obligations remain.
### Server replacement requires admitted bytes and a confirmed inactive service
docs/release-control/v6/internal/subsystems/registry.json
+15 -2
View File
@@ -4953,6 +4953,20 @@
"scripts/release_control/ssh_host_key_policy_test.py"
]
},
{
"id": "unattended-update-runtime",
"label": "unattended updater runtime proof",
"match_prefixes": [],
"match_files": [
"scripts/pulse-auto-update.sh"
],
"allow_same_subsystem_tests": false,
"test_prefixes": [],
"exact_files": [
"scripts/installtests/pulse_auto_update_consent_test.go",
"scripts/installtests/pulse_auto_update_test.go"
]
},
{
"id": "deployment-script-runtime",
"label": "deployment script runtime proof",
@@ -4962,8 +4976,7 @@
"install.sh",
"scripts/install-container-agent.sh",
"scripts/install-docker.sh",
"scripts/install.ps1",
"scripts/pulse-auto-update.sh"
"scripts/install.ps1"
],
"allow_same_subsystem_tests": false,
"test_prefixes": [],
scripts/release_control/canonical_completion_guard_test.py
+45 -7
View File
@@ -906,7 +906,7 @@ class CanonicalCompletionGuardTest(unittest.TestCase):
],
)
def test_auto_update_script_change_uses_deployment_script_policy(self):
def test_auto_update_script_change_uses_unattended_update_policy(self):
required = infer_impacted_subsystems(["scripts/pulse-auto-update.sh"])
self.assertEqual(set(required), {"deployment-installability"})
@@ -923,22 +923,60 @@ class CanonicalCompletionGuardTest(unittest.TestCase):
installability["verification_requirements"],
[
{
"id": "deployment-script-runtime",
"label": "deployment script runtime proof",
"id": "unattended-update-runtime",
"label": "unattended updater runtime proof",
"touched_runtime_files": ["scripts/pulse-auto-update.sh"],
"allow_same_subsystem_tests": False,
"test_prefixes": [],
"exact_files": [
"scripts/installtests/install_docker_sh_test.go",
"scripts/installtests/install_ps1_test.go",
"scripts/installtests/install_sh_test.go",
"scripts/installtests/pulse_auto_update_consent_test.go",
"scripts/installtests/pulse_auto_update_test.go",
"scripts/installtests/root_install_sh_test.go",
],
}
],
)
def test_standalone_consent_proof_is_confined_to_unattended_updater(self):
rule = next(
rule for rule in load_subsystem_rules()
if rule["id"] == "deployment-installability"
)
proof = "scripts/installtests/pulse_auto_update_consent_test.go"
update_requirement = build_verification_requirements(
rule, ["scripts/pulse-auto-update.sh"]
)[0]
self.assertEqual(update_requirement["id"], "unattended-update-runtime")
self.assertEqual(
staged_verification_files_for_requirement(rule, update_requirement, [proof]),
[proof],
)
for unmatched in [[], ["scripts/installtests/unrelated_test.go"]]:
with self.subTest(unmatched=unmatched):
self.assertEqual(
staged_verification_files_for_requirement(
rule, update_requirement, unmatched
),
[],
)
for runtime in [
"install.sh",
"scripts/install.ps1",
"scripts/install-docker.sh",
"scripts/install-container-agent.sh",
"docker-compose.yml",
]:
with self.subTest(runtime=runtime):
requirements = build_verification_requirements(rule, [runtime])
self.assertTrue(requirements)
for requirement in requirements:
self.assertNotEqual(requirement["id"], "unattended-update-runtime")
self.assertEqual(
staged_verification_files_for_requirement(
rule, requirement, [proof]
),
[],
)
def test_vite_config_change_uses_frontend_build_output_policy(self):
required = infer_impacted_subsystems(["frontend-modern/vite.config.ts"])
self.assertEqual(set(required), {"deployment-installability"})
scripts/release_control/subsystem_lookup_test.py
+2 -5
View File
@@ -3722,16 +3722,13 @@ class SubsystemLookupTest(unittest.TestCase):
self.assertEqual(match["lane_context"]["lane_id"], "L1")
self.assertEqual(
match["verification_requirement"]["id"],
"deployment-script-runtime",
"unattended-update-runtime",
)
self.assertEqual(
match["verification_requirement"]["exact_files"],
[
"scripts/installtests/install_docker_sh_test.go",
"scripts/installtests/install_ps1_test.go",
"scripts/installtests/install_sh_test.go",
"scripts/installtests/pulse_auto_update_consent_test.go",
"scripts/installtests/pulse_auto_update_test.go",
"scripts/installtests/root_install_sh_test.go",
],
)